0

Is there a registry setting or something to limit the number of individual services that are run within a single svchost.exe process?

I'm aware of the WIN32_SHARE_PROCESS flag and the sc application's ability to make individual services run in their own process, but I don't want the overhead of a process for each of the dozens of services. Ideally I would like to see the 30 services from Automatic Updates through Workstation that are currently hosted by a single process be shared among three to five processes.

Peter Mortensen
  • 2,319
  • 5
  • 23
  • 24
Tim Sylvester
  • 187
  • 9

2 Answers2

2

You can control which services get bundled together into a single svchost process by modifying the Registry entries at HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/SvcHost. You'll be modifying the values, each of which contains a list of the services that run within it (e.g. netsvcs).

There's a bit more information about this out there, much of it related to the Conficker worm and cleaning up after it. This is based on research related to a situation where I had to manually clean out traces of some malware services.

Update with additional resources/information: There's not a lot of information out there and I haven't experimented with this yet, but the most useful information I found earlier while researching was:

fencepost
  • 972
  • 6
  • 10
  • I saw a reference to that path in a MS KB article (#314056), but I got the impression that I can't just change those values. For example, the `netsvcs` group has server, workstation, etc., in it, and if you look at the service descriptors for those services in `System\CurrentControlSet\Services`, they reference `netsvcs` in their `ImagePath` setting. Is it safe to re-arrange the groups as long as I update the `ImagePath` for all the services that are moved? – Tim Sylvester Dec 07 '09 at 21:30
  • Post revised with additional resources including ones with step-by-step of changes needed. – fencepost Dec 07 '09 at 23:42
  • That first link is just what I was looking for. Thanks! – Tim Sylvester Dec 07 '09 at 23:54
1

You won't notice any improvement in performance by doing this...

If you want to start some services on demand, set them to Manual start and Windows will start the service when it is trying to be accessed.

If you want visibility into what service is causing a performance issue try launching a command prompt and using this command: C:\>tasklist /svc /FI "IMAGENAME eq svchost.exe"

That will show you all svchost.exe instances, which services are running in each process, and the PID (process ID).

Once you know the PID you can launch Task Manager (Ctrl+Alt+Del) and in the Processes tab go to View > Select Columns... and chose to show PIDs.

Then you'll know which svchost.exe is causing your performance issue, and you can cross reference the PID to your list of services running in that instance of svchost.exe.

Hope this helps address the underlying reason for your question.

Garrett
  • 1,598
  • 4
  • 14
  • 25
  • I'm aware that running more hosts will actually *reduce* performance slightly since those services can no longer share resources. I want to be able to dynamically reduce the priority of processes that are using a lot of CPU without affecting nearly all the services at once, but I was also trying to find a balance between that and having every service use its own process. For a one-time analysis I would use the script from http://serverfault.com/questions/12278 to set them all to "own" and set them all back to shared when I found the problem, but I'm looking for something more dynamic. – Tim Sylvester Dec 07 '09 at 21:34
  • SC Config Type=own You can set them all to own, find your culprits, and then set everything back to share, except the culprits? – Garrett Dec 08 '09 at 21:13